Virtualization places a guest system into a separate security domain,
typically with less privileges than software running directly on the host.
Increasingly, there is interest in creating multiple security domains
within a single virtualized system as well.  CPU vendors (and software
vendors too) are implementing solutions; each of which, of course, is
different from all of the others.  KVM planes, currently under development
by J├╢rg R├╢del, Paolo Bonzini, and others in the KVM community, is an
attempt to provide an abstraction layer that makes all of these features
available on Linux systems; it is not a small task.

https://lwn.net/Articles/1087590/
--- SBBSecho 3.37-Linux
 * Origin: Palantir * palantirbbs.ddns.net * Pensacola, FL * (618:250/24)